DISARM, decoded.
The framework maps, step by step, how information-manipulation operations are built. Powerful but reserved for insiders, it is made legible here, without diluting the trade's vocabulary. Every code keeps its official English name; a plain-language gloss is added beside it.
(Disinformation Analysis and Response Measures) is an open framework maintained by the . Built in the lineage of (the reference matrix of cyber-attack techniques) it transposes the same logic to the information domain: a shared, citable repertoire of adversarial behaviour. Its grammar is hierarchical: four macro (Plan → Prepare → Execute → Assess) break down into (the intermediate objectives), themselves realised by concrete . Analysts, journalists, diplomats and researchers use it to describe a campaign in a shared language and to compare operations. This section offers a teaching-oriented reading of it.
Official framework · github.com/DISARMFoundation/DISARMframeworks ↗
- P01act 1Plan
Define the strategy: what end state the operation is after.
- P02act 2Prepare
Prepare the means: fake actors, content, channels, targeting.
- P03act 3Execute
Deploy and amplify: deliver, flood, harass.
- P04act 4Assess
Assess effects and adjust for what comes next.
The backbone of the framework and of this section: every operation reads along these four acts, from strategic design to the assessment of effects.
Phases · tactics · techniques
Seed Kernel of Truth
In plain termsWrap the lie around a kernel of truth.
- Parent tactic
- TA08 Conduct Pump Priming
- Phase
- P03 · Execute
- Sub-techniques
- ·
- DISARM version
- captured 1 June 2026
Wrap lies or altered context/facts around truths. Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters.
Source: DISARM Foundation , framework published under an open licence (CC), in the lineage of MITRE ATT&CK. French adaptation and localisation by Elie Abousaab, as part of the doctoral thesis Epistemic security and the mechanisms of FIMI in France and the European Union, CEDS Paris. This interface is a teaching aid, not an original work of the framework.
DISARM codes evolve; validate against the current version.·Version: DISARM master, captured 1 June 2026·Captured: 2026-06-01·No cookies · no tracking
What are the codes for?
A DISARM code is an address within a three-level grammar. The (P01–P04) situates the moment of the operation: plan, prepare, execute, assess. The (TA01–TA18) names the intermediate objective, for instance “develop narratives”. The (T0xxx) describes the concrete method, sometimes with sub-techniques (T0xxx.yyy).
Why keep the English names? Because a code is only worth something if it is citable and comparable. T0086 means the same thing to an analyst in Paris, Brussels or Washington; translating the name would break this international standard. The French gloss serves access, not substitution.
Reading a campaign's means reading the list of codes it activated, placed back on the four-act chain. Two campaigns sharing many codes resemble each other in their modus operandi. That is exactly what the Diagnose and Play modes reconstruct.
Source: DISARM Foundation , framework published under an open licence (CC), in the lineage of MITRE ATT&CK. French adaptation and localisation by Elie Abousaab, as part of the doctoral thesis Epistemic security and the mechanisms of FIMI in France and the European Union, CEDS Paris. This interface is a teaching aid, not an original work of the framework.
DISARM codes evolve; validate against the current version.·Version: DISARM master, captured 1 June 2026·Captured: 2026-06-01·No cookies · no tracking